diff --git a/glance/api/cached_images.py b/glance/api/cached_images.py index 15d6b45a49..04d1c0ce40 100644 --- a/glance/api/cached_images.py +++ b/glance/api/cached_images.py @@ -17,6 +17,7 @@ Controller for Image Cache Management API """ +from oslo_log import log as logging import webob.exc from glance.api import policy @@ -25,6 +26,8 @@ from glance.common import exception from glance.common import wsgi from glance import image_cache +LOG = logging.getLogger(__name__) + class Controller(controller.BaseController): """ @@ -40,6 +43,7 @@ class Controller(controller.BaseController): try: self.policy.enforce(req.context, 'manage_image_cache', {}) except exception.Forbidden: + LOG.debug("User not permitted to manage the image cache") raise webob.exc.HTTPForbidden() def get_cached_images(self, req): diff --git a/glance/api/middleware/cache.py b/glance/api/middleware/cache.py index 10a90e39ab..279f88feb7 100644 --- a/glance/api/middleware/cache.py +++ b/glance/api/middleware/cache.py @@ -101,6 +101,7 @@ class CacheFilter(wsgi.Middleware): try: self.policy.enforce(req.context, action, target) except exception.Forbidden as e: + LOG.debug("User not permitted to perform '%s' action" % action) raise webob.exc.HTTPForbidden(explanation=e.msg, request=req) def _get_v1_image_metadata(self, request, image_id): diff --git a/glance/api/v1/images.py b/glance/api/v1/images.py index e33b91fbca..52006c3f13 100644 --- a/glance/api/v1/images.py +++ b/glance/api/v1/images.py @@ -152,6 +152,7 @@ class Controller(controller.BaseController): try: self.policy.enforce(req.context, action, target) except exception.Forbidden: + LOG.debug("User not permitted to perform '%s' action" % action) raise HTTPForbidden() def _enforce_image_property_quota(self, diff --git a/glance/api/v1/members.py b/glance/api/v1/members.py index 2727d555c5..ba0204c223 100644 --- a/glance/api/v1/members.py +++ b/glance/api/v1/members.py @@ -46,6 +46,7 @@ class Controller(controller.BaseController): try: self.policy.enforce(req.context, action, {}) except exception.Forbidden: + LOG.debug("User not permitted to perform '%s' action" % action) raise webob.exc.HTTPForbidden() def _raise_404_if_image_deleted(self, req, image_id): @@ -99,7 +100,8 @@ class Controller(controller.BaseController): LOG.debug(utils.exception_to_str(e)) raise webob.exc.HTTPNotFound(explanation=e.msg) except exception.Forbidden as e: - LOG.debug(utils.exception_to_str(e)) + LOG.debug("User not permitted to remove membership from image " + "'%s'" % image_id) raise webob.exc.HTTPNotFound(explanation=e.msg) return webob.exc.HTTPNoContent() diff --git a/glance/api/v2/image_actions.py b/glance/api/v2/image_actions.py index 37a66acc4d..34bde03942 100644 --- a/glance/api/v2/image_actions.py +++ b/glance/api/v2/image_actions.py @@ -52,6 +52,7 @@ class ImageActionsController(object): except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to deactivate image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.InvalidImageStatusTransition as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) @@ -67,6 +68,7 @@ class ImageActionsController(object): except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to reactivate image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.InvalidImageStatusTransition as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) diff --git a/glance/api/v2/image_data.py b/glance/api/v2/image_data.py index 4025eebde0..660bd20d74 100644 --- a/glance/api/v2/image_data.py +++ b/glance/api/v2/image_data.py @@ -180,6 +180,7 @@ class ImageDataController(object): except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to download image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) return image @@ -228,6 +229,7 @@ class ResponseSerializer(wsgi.JSONResponseSerializer): glance_store.StoreRandomGetNotSupported) as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to download image '%s'" % image) raise webob.exc.HTTPForbidden(explanation=e.msg) # NOTE(saschpe): "response.app_iter = ..." currently resets Content-MD5 # (https://github.com/Pylons/webob/issues/86), so it should be set diff --git a/glance/api/v2/images.py b/glance/api/v2/images.py index 589b25ff81..934b840079 100644 --- a/glance/api/v2/images.py +++ b/glance/api/v2/images.py @@ -68,6 +68,7 @@ class ImagesController(object): except exception.Invalid as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to create image") raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.InvalidParameterValue as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) @@ -116,6 +117,7 @@ class ImagesController(object): exception.InvalidFilterRangeValue) as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve images index") raise webob.exc.HTTPForbidden(explanation=e.msg) result['images'] = images return result @@ -125,6 +127,7 @@ class ImagesController(object): try: return image_repo.get(image_id) except exception.Forbidden as e: + LOG.debug("User not permitted to show image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -148,6 +151,7 @@ class ImagesController(object): except exception.Invalid as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) except exception.Forbidden as e: + LOG.debug("User not permitted to update image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.InvalidParameterValue as e: raise webob.exc.HTTPBadRequest(explanation=e.msg) @@ -220,6 +224,7 @@ class ImagesController(object): image.delete() image_repo.remove(image) except exception.Forbidden as e: + LOG.debug("User not permitted to delete image '%s'" % image_id) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: msg = (_("Failed to find image %(image_id)s to delete") % diff --git a/glance/api/v2/metadef_namespaces.py b/glance/api/v2/metadef_namespaces.py index 1d00b5f7d8..ab55a24bb4 100644 --- a/glance/api/v2/metadef_namespaces.py +++ b/glance/api/v2/metadef_namespaces.py @@ -95,6 +95,8 @@ class NamespaceController(object): namespaces.next = namespace_list[-1].namespace except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata namespaces " + "index") raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -166,6 +168,7 @@ class NamespaceController(object): except exception.Forbidden as e: self._cleanup_namespace(ns_repo, namespace, namespace_created) + LOG.debug("User not permitted to create metadata namespace") raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: self._cleanup_namespace(ns_repo, namespace, namespace_created) @@ -259,6 +262,8 @@ class NamespaceController(object): namespace_detail.tags = tag_list except exception.Forbidden as e: + LOG.debug("User not permitted to show metadata namespace " + "'%s'" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -285,6 +290,8 @@ class NamespaceController(object): wsme_utils._get_value(user_ns.owner) or req.context.owner) updated_namespace = namespace_repo.save(ns_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to update metadata namespace " + "'%s'" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -305,6 +312,8 @@ class NamespaceController(object): namespace_obj.delete() namespace_repo.remove(namespace_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata namespace " + "'%s'" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -319,6 +328,8 @@ class NamespaceController(object): namespace_obj.delete() ns_repo.remove_objects(namespace_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata objects " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -333,6 +344,8 @@ class NamespaceController(object): namespace_obj.delete() ns_repo.remove_tags(namespace_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata tags " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -347,6 +360,8 @@ class NamespaceController(object): namespace_obj.delete() ns_repo.remove_properties(namespace_obj) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata properties " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) diff --git a/glance/api/v2/metadef_objects.py b/glance/api/v2/metadef_objects.py index bad2c96e76..470220dd43 100644 --- a/glance/api/v2/metadef_objects.py +++ b/glance/api/v2/metadef_objects.py @@ -61,6 +61,8 @@ class MetadefObjectsController(object): object_repo.add(new_meta_object) except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata object within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -90,6 +92,8 @@ class MetadefObjectsController(object): metadef_objects = MetadefObjects() metadef_objects.objects = object_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata objects within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -108,6 +112,8 @@ class MetadefObjectsController(object): get_object_href(namespace, metadef_object), self.obj_schema_link) except exception.Forbidden as e: + LOG.debug("User not permitted to show metadata object '%s' " + "within '%s' namespace" % (namespace, object_name)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -130,6 +136,8 @@ class MetadefObjectsController(object): metadata_object.properties) updated_metadata_obj = meta_repo.save(metadef_object) except exception.Forbidden as e: + LOG.debug("User not permitted to update metadata object '%s' " + "within '%s' namespace " % (object_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -150,6 +158,8 @@ class MetadefObjectsController(object): metadef_object.delete() meta_repo.remove(metadef_object) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata object '%s' " + "within '%s' namespace" % (object_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) diff --git a/glance/api/v2/metadef_properties.py b/glance/api/v2/metadef_properties.py index 0889e2cbec..a0ab9fa249 100644 --- a/glance/api/v2/metadef_properties.py +++ b/glance/api/v2/metadef_properties.py @@ -73,6 +73,8 @@ class NamespacePropertiesController(object): namespace_properties = PropertyTypes() namespace_properties.properties = property_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata properties " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -103,6 +105,8 @@ class NamespacePropertiesController(object): db_property = prop_repo.get(namespace, property_name) property = self._to_model(db_property) except exception.Forbidden as e: + LOG.debug("User not permitted to show metadata property '%s' " + "within '%s' namespace" % (property_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -119,6 +123,8 @@ class NamespacePropertiesController(object): namespace=namespace, **self._to_dict(property_type)) prop_repo.add(new_property_type) except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata property within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -138,6 +144,8 @@ class NamespacePropertiesController(object): db_property_type.schema = (self._to_dict(property_type))['schema'] updated_property_type = prop_repo.save(db_property_type) except exception.Forbidden as e: + LOG.debug("User not permitted to update metadata property '%s' " + "within '%s' namespace" % (property_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -155,6 +163,8 @@ class NamespacePropertiesController(object): property_type.delete() prop_repo.remove(property_type) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata property '%s' " + "within '%s' namespace" % (property_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) diff --git a/glance/api/v2/metadef_resource_types.py b/glance/api/v2/metadef_resource_types.py index dd27004f3c..4fb9e90ff6 100644 --- a/glance/api/v2/metadef_resource_types.py +++ b/glance/api/v2/metadef_resource_types.py @@ -60,6 +60,8 @@ class ResourceTypeController(object): resource_types = ResourceTypes() resource_types.resource_types = resource_type_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata resource types " + "index") raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -80,6 +82,8 @@ class ResourceTypeController(object): resource_types = ResourceTypeAssociations() resource_types.resource_type_associations = resource_type_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata resource types " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -98,6 +102,8 @@ class ResourceTypeController(object): rs_type_repo.add(new_resource_type) except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata resource type " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -123,6 +129,9 @@ class ResourceTypeController(object): if not found: raise exception.NotFound() except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata resource type " + "'%s' within '%s' namespace" % (resource_type, + namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: msg = (_("Failed to find resource type %(resourcetype)s to " diff --git a/glance/api/v2/metadef_tags.py b/glance/api/v2/metadef_tags.py index 74517dfc55..8c1252948f 100644 --- a/glance/api/v2/metadef_tags.py +++ b/glance/api/v2/metadef_tags.py @@ -60,6 +60,8 @@ class TagsController(object): **tag_name_as_dict) tag_repo.add(new_meta_tag) except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata tag within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -85,6 +87,8 @@ class TagsController(object): metadef_tags = MetadefTags() metadef_tags.tags = tag_list_out except exception.Forbidden as e: + LOG.debug("User not permitted to create metadata tags within " + "'%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -117,6 +121,8 @@ class TagsController(object): metadef_tags = MetadefTags() metadef_tags.tags = tag_list except exception.Forbidden as e: + LOG.debug("User not permitted to retrieve metadata tags " + "within '%s' namespace" % namespace) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -132,6 +138,8 @@ class TagsController(object): metadef_tag = meta_tag_repo.get(namespace, tag_name) return MetadefTag.to_wsme_model(metadef_tag) except exception.Forbidden as e: + LOG.debug("User not permitted to show metadata tag '%s' " + "within '%s' namespace" % (tag_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -148,6 +156,8 @@ class TagsController(object): metadata_tag.name) updated_metadata_tag = meta_repo.save(metadef_tag) except exception.Forbidden as e: + LOG.debug("User not permitted to update metadata tag '%s' " + "within '%s' namespace" % (tag_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg) @@ -166,6 +176,8 @@ class TagsController(object): metadef_tag.delete() meta_repo.remove(metadef_tag) except exception.Forbidden as e: + LOG.debug("User not permitted to delete metadata tag '%s' " + "within '%s' namespace" % (tag_name, namespace)) raise webob.exc.HTTPForbidden(explanation=e.msg) except exception.NotFound as e: raise webob.exc.HTTPNotFound(explanation=e.msg)